After using the chrome debugger to inspect the ajax requests of Facebook (for curiosity), I noticed that the response is in JSON, however it is always prefixed with
for(;;);
In example, if the JSON were {hello:"world"}, then Facebook would respond
for(;;); {hello:"world"}
Does this have any use? I imagine it must have a purpose...
The prevention of JSON hijacking is the use case:
Evil websites on other domains can't make AJAX requests to get this data due to the same-origin policy, but they can include the URL via a
<script>tag. The URL is visited with your cookies, and by overriding the global array constructor or accessor methods they can have a method called whenever an object (array or hash) attribute is set, allowing them to read the JSON content.
The empty for statement causes an infinite loop, which blocks the data from being used in a non-AJAX context.
References
evaled?